Back to list
@stake: AppleFileServer Remote Command Execution
May 03 2004 10:33PM
@stake Advisories (advisories atstake com)
-----BEGIN PGP SIGNED MESSAGE-----
Advisory Name: AppleFileServer Remote Command Execution
Release Date: 05/03/2004
Platform: MacOS X 10.3.3 and below
Severity: A remote attacker can execute arbitrary
commands as root
Authors: Dave G. <daveg (at) atstake (dot) com [email concealed]>
Dino Dai Zovi <ddaizovi (at) atstake (dot) com [email concealed]>
Vendor Status: Informed, Upgrade Available
CVE Candidate: CAN-2004-0430
The AppleFileServer provides Apple Filing Protocol (AFP) services for
both Mac OS X and Mac OS X server. AFP is a protocol used to
remotely mount drives, similar to NFS or SMB/CIFS. There is a
pre-authentication, remotely exploitable stack buffer overflow that
allows an attacker to obtain administrative privileges and execute
commands as root.
The AppleFileServer provides Apple Filing Protocol (AFP) services
for both Mac OS X and Mac OS X server. AFP is a protocol used to
remotely mount drives, similar to NFS or SMB/CIFS. AFP is not
enabled by default. It is enabled through the Sharing Preferences
section by selecting the 'Personal File Sharing' checkbox.
Thereis a pre-authentication remotely exploitable stack buffer
overflow that allows an attacker to obtain administrative
privileges. The overflow occurs when parsing the PathName argument
from LoginExt packet requesting authentication using the Cleartext
Password User Authentication Method (UAM). The PathName argument
is encoded as one-byte specifying the string type, two-bytes
specifying the string length, and finally the string itself. A
string of type AFPName (0x3) that is longer than the length declared
in the packet will overflow the fixed-size stack buffer.
The previously described malformed request results in a trivially
exploitable stack buffer overflow. @stake was able to quickly
develop a proof-of-concept exploit that portably demonstrates this
vulnerability across multiple Mac OS X versions including Mac OS X
10.3.3, 10.3.2, and 10.2.8.
- From APPLE-SA-2004-05-03 Security Update 2004-05-03
AppleFileServer: Fixes CAN-2004-0430 to improve the handling of long
passwords. Credit to Dave G. from @stake for reporting this issue.
Security Update 2004-05-03 may be obtained from:
* Software Update pane in System Preferences
* Apple's Software Downloads web site:
For Mac OS X 10.3.3 "Panther"
The download file is named: "SecUpd2004-05-03Pan.dmg"
Its SHA-1 digest is: 6f35539668d80ee536305a4146bd982a93706532
For Mac OS X Server 10.3.3
The download file is named: "SecUpdSrvr2004-05-03Pan.dmg"
Its SHA-1 digest is: 3c7da910601fd36d4cdfb276af4783ae311ac5d7
For Mac OS X 10.2.8 "Jaguar"
The download file is named: "SecUpd2004-05-03Jag.dmg"
Its SHA-1 digest is: 11d5f365e0db58b369d85aa909ac6209e2f49945
For Mac OS X Server 10.2.8
The download file is named: "SecUpdSrvr2004-05-03Jag.dmg"
Its SHA-1 digest is: 28859a4c88f6e1d1fe253388b233a5732b6e42fb
3/26/2004 Vendor notified of issue
5/04/2004 Vendor informs us that they have a patch available
4/04/2004 Advisory released
If you do not need AFS, disable it. If you do need it, upgrade to
the latest version of Panther.
Common Vulnerabilities and Exposures (CVE) Information:
The Common Vulnerabilities and Exposures (CVE) project has assigned
the following names to these issues. These are candidates for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.
CAN-2004-0430 AppleFileServer Remote Command Execution
Open Source Vulnerability Database (OSVDB) Information:
More information available at www.osvdb.org
OSVDB ID 5762
@stake Vulnerability Reporting Policy:
@stake Advisory Archive:
Copyright 2004 @stake, Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.3
-----END PGP SIGNATURE-----
[ reply ]
Copyright 2010, SecurityFocus